It Is a Hard Business

"Is it a bigger crime to rob a bank or to open one?" Ted Allan

  The New Mexico Attorney General's  war on the consumer retail , credit and financial services industries continues.    I am using the term "financial service" in the broadest scope to include everything from "pay-day" lenders to banks and credit unions.

In late March 2014 the N.M. Supreme Court circulated a proposed rule which would  add detailed new provisions for the contents of consumer collection complaints for district courts and magistrate courts   in consumer debt collections.  The N.M. Attorney General's Consumer Protection Division Chief, Karen Meyers, has proposed  the new rules to correct what the Division's Chief views as creditors' filing  bad faith claims and then getting default judgments which are not  supported by evidence.    

Under the AG's proposed new rule the complaint in a consumer collection action would have to include substantial additional allegations beyond the present rule requirements to enable a creditor to gain a default judgement.  The requirements include the name of the creditor, how the creditor became creditor (assignment details, etc.),    due date and detailed interest calculations, statute of limitations and details on when the statute commenced to run, proof that the named debtor is the debtor,  and copies of all documents used in interest and amounts due calculations.  Third party credit collection agencies must furnish licensure information. In order to get a default judgment against the debtor, the creditor must certify compliance with the new rule.

Karen Meyers was interviewed by Dennis Domrzalski of the Albuquerque Business First weekly and said that the new rule " requires that the original contract be attached [to the lawsuit] and information that shows a good-faith basis for the suit and allows the person who has been sued to defend themselves."  She added, " In many instances you have collectors filing lawsuits based on insufficient evidence, filing suits when they don’t have a good-faith basis for the claim and failing to notify consumers” .

The proposed rule is not targeted toward any specific type of creditor or type of consumer transaction: it covers banks, credit unions, "payday"lenders, automobile dealer credit services, ad infinitum.  It will require detailed and careful attorney involvement in the minutiae of the credit transaction.  Although "designed" to police the entry of default judgments, it will furnish grounds for motions to dismiss in contested cases in which the parties know all details of the  obligation.

If the proposed rule is adopted, the impact on foreclosures times is unknown.  Now even the simplest foreclosures take nine months to a year in most judicial districts. Default judgement or not, the added attorney fee costadded to the judgment is ignored by the rule's sponsor.

Whether the Supreme Court will adopt the new consumer rule is unknown.  The Court will send the proposed rule to its Rules Committee, a collection of experienced attorneys.  It may be sometime before a decision is made.  However, it is one more step in what appears to be an offensive against banks--and not bank robbers.

Ed O'Leary, a former New Mexico banker,  writes a Blog for the
American Bankers Association.  I mentioned to Ed my surprise at Bank of America's embarrassing accounting snafu which interfered with  its stock buyback.  He referred me to his current Blog--"Do We Take Financial Statements Too Seriously"--which you can find at http://www.ababj.com/Blogs > Blogs > Talking Credit.  I recommend it with all due respects to my accountant friends and my deep reverence for GAAP.

Do good,

MARSHALL G. MARTIN
mgm@marshallgmartin.com
(505) 228-8506

Dodd Frank and Diversity

ATTORNEY: Are you qualified to give a urine sample? 
       WITNESS: Are you qualified to ask that question? 
  (Disorder in the American Courts)       


There may be no burning issues for financial institutions since the legislature is not in session and compliance staffs are trying to insure that their financial institution can master the CFPB’s mortgage and associated regulations—maybe an issue, but just smoldering.

As I was traveling a busy Albuquerque street on Friday last I was crowded by one of Albuquerque’s long double length buses.  Being always ready to make a buck, the city emblazoned along the complete length of one of the double buses giant advertisements that cover the windows (apparently without impairing passengers’ views).  As I looked up I saw a full bus length advertisement on the New Mexico Attorney General’s foreclosure relief program.  It said, roughly, “have foreclosure problems call the N.M. Attorney General,” etc.  It was in lettering approximately two to three feet high. It had a website, which touts the Attorney General “Home Preservation” program.  I checked the website.  It has helpful information in somewhat lurid detail.  It seems to address a problem that implies that all foreclosures may be tainted.  There is no question that there have been abuses in the foreclosure process and this may be part of the Attorney General’s participation in the settlements of such cases. However, as we climb out of the mortgage crisis, one wonders if a bit of restraint is not needed.  

The Albuquerque Business First has had a series of articles on the impact of Dodd-Frank regulations on community banks. It has surveyed bankers across the state.  The focus has been on CFPB regulations, but one of the articles focused on a general Dodd-Frank provision, which has had little attention---the “diversity” provision of Section 342 of the Act which mandates diversity and establishment of the Office of Minority and Women Inclusion ( “OMWI”) in each regulatory agency. Standards for diversity practices for each financial institution regulated by that agency must be established.   The comment period is under way.  I recommend reviewing the comments by the American Bankers Association and other associations.  (http://www.aba.com/Advocacy/commentletters/Documents/clOMWIdiversitypolicies2014Feb.pdf .)  It is somewhat disturbing that some comments to the proposal argue for more sweeping and draconian provisions for the final regulations. 

Some banks have already been subject to reporting requirements regarding diversity in hiring practices. In particular, banks with 100 or more employees and banks that are federal contractors and employ 50 or more employees are required to file Employer Information Report EEOC-1 with the Equal Employment Opportunity Commission and the Office of Federal Contract Compliance Programs.  Banks that serve as depositories for US funds or banks that are issuing or paying agent or for U.S. Savings Bonds and Notes are covered so long as they employ 50 or more workers.  These existing requirements will not change under the proposal.  Most importantly, the proposal does not extend the filing or maintenance of such report to banks not currently filing them.  The proposal does suggest voluntary maintenance of reports having similar information may be advisable.

The proposal has typical vague standards such as organizational commitment to diversity, workforce profile and employment practices, vendor diversity and “transparency”.  Board involvement is suggested for management and employee diversity programs.  There is some recognition that vendor diversity may be a difficult program in community banks-- but not much.

         The Joint Statement speaks in terms of  “assessments” which will apparently be ideally both a “self assessment” and an agency assessment.   With regard to the agency assessment, the Joint Statement specifically states that diversity will not become the subject of a separate examination procedure.  This is a nod to Dodd-Frank Section 342 (b)(4) which states an assessment of diversity practices of a regulated entity   may not be “construed to mandate any requirement or otherwise affect the lending policies and practices of any regulated entity, or to require any specific action based on the finding of (an) assessment."  We will see if in practice the restriction of Dodd-Frank is followed by the regulatory agencies in actual practice. 

Do Good,

Marshall G. Martin

(505) 228 8506

        

Data Breach--Cyber Risk and No Reward

“The reserve side also has a reverse side”.  Japanese Proverb

Target and Nieman Marcus have suffered massive data breaches.  The New Mexico legislature reacts with a Data Breach Notification Act (HB 224-Rehm) and Congress reactivates numerous legislative proposals on data breaches, and brings forth at least one new version.

Apparently New Mexico is one of the few remaining states in the U.S. without some form of data breach notification statute.  The ever present Consumer Protection section of the New Mexico Attorney General’s office stepped in and pushed HB224.  Although HB224 had significant committee support it was deeply flawed in its scope.  It apparently went through five or six versions and died at adjournment.  Banking legislative representatives managed to get the final version of HB224 to except from its application any entity subject to the Gramm-Leach-Bliley privacy provisions.  HB224 still had a wide scope outside credit card and banking, including applying the notification requirements to any “person” who gathered sensitive data subject to the Act—Social Security data, credit card, drivers’ license data, etc.  “Person” was not defined.

Before the New Mexico legislature convened, and contemporaneous with it, the U. S. Congress got in the act.  More than a half dozen forms of data breach legislation had been introduced in 2011-2012 and died.

 The most recent data breach notification bill is broader than the New Mexico version (HB224).  In mid-February, Senators Blumenthal and Markey introduced the Personal Data Protection and Breach Accountability Act (“PDPBA”). PDPBA applies to any commercial or non-profit association that stores personal consumer information of a sensitive nature.  It requires those subject to the Act to implement data security and privacy programs, preempts other state or federal notification laws, provides for civil and criminal penalties and requires federal enforcement agencies to gather information on compliance with the Act.  Under PDPBA the primary enforcement authority is the Justice Department, with rules and some involvement by the Federal Trade Commission.  PDPBA also has a private right of action. There is no Gramm-Leach-Bliley exception.

 Senator Diane Feinstein and others have introduced similar legislation, Data Security and Breach Notification Act (“DSBA”) in the last days of January 2014.  DSBA is not as broad in its scope and primarily focuses on notification of data breaches.  It is almost identical to legislation proposed in 2011.    The Federal Trade Commission is charged with issuing standards for notification.  There is a significant question if DSBA would preempt state law on data breach notification unless the state law was more lenient. 

The data breach notification in the U.S. Congress has come alive and the outcome in an election year with a divided Congress is anyone’s guess.

At present for most New Mexico banks a far more dangerous risk is presented by Patco Construction Co. v. People’s United Bank, a 2013 decision out of the federal Court of Appeal for 1^st Circuit—covering the most North-Eastern states above New York.  I have discussed the case before, but it continues to get attention in the legal journals.  It bears revisiting.  Patco lost over $345,000 when sophisticated hackers got access to Patco’s ID and passwords for ACH transactions and started withdrawing funds.  After some time the bank discovered the invasion of Patco’s accounts.  Under a very one-sided ACH agreement between Patco and the bank, Patco had no chance of recovery—the agreement limited damages and essentially shifted all responsibility to Patco.   The bank won.  But on appeal the Court of Appeals reversed.  Applying Section 4A of the Maine Uniform Commercial Code,  the Court of Appeals in effect held that although the bank could shift the risk of the ACH account’s operation to the customer, but only if the bank’s security procedures were “commercially reasonable”.  The bank did not have commercially reasonable security procedures and, in this case, they were not applied in a commercially reasonable way.  Thus under Patco the requirement that the bank’s security procedures be commercially reasonable under Section 4A of the Uniform Commercial Code overrides the most bank friendly agreement.

In my view Patco presents the best case for a bank’s attorney (not its insurance agent) to review the risk of hacker’s invasion of a customer’s accounts against the bank’s liability and cyber-insurance policies.  In a Patco situation it is likely that the bank’s liability policy will apply.  However, cyber-insurance policies are changing with the risks and types of damages incurred and the cyber-insurance should be reviewed, 

At the urging of New Mexico Attorney General the District Courts for Sandoval and Valencia Counties (13^th Judicial District) has just instituted a mandatory mediation procedure for all consumer foreclosure cases filed in that District.  The procedures are similar to those in the Santa Fe District Courts.  Experience has shown that the procedures add more time to an already delay plagued process.  Although the plan does not apply to commercial foreclosures, the Santa Fe courts did apply the mediation to some commercial foreclosures when defendants urged the court to force mediation.

Do Good,

Marshall G. Martin

mgm@marshallgmartin.com

(505) 228-8506